The record has a location
Qatar's data protection rules, sector-specific Qatar Central Bank requirements and national AI guidance make deployment context important. A system may process locally yet send its decision trail to a service outside the institution's required boundary.
Oversight must be demonstrable
Regulated institutions need a way to show which rule applied, which output was allowed or held and who made a consequential human decision. Evidence should remain available to the people and supervisors entitled to inspect it.
Build the boundary into the architecture
In-country deployment can keep the model, runtime controls and audit trail together. The important test is whether the institution can produce a complete, attributable record without depending on an external evidence store.
Qatar PDPPL · QCB data-handling, cloud and AI requirements · NCSA AI guidance (2024)